1. Field of the Invention
This invention relates to data processing systems. More particularly, this invention relates to malware scanning, such as, for example, scanning for computer viruses, worms, Trojans, banned files, banned words etc, within computer files.
2. Description of the Prior Art
It is known to provide malware scanners that examine computer files to determine whether they contain malware, such as computer viruses, worms, Trojans, banned files, banned words, banned images, etc. The damage that can be caused to a computer system or computer network by malware is significant and accordingly the use of such malware scanners is highly desirable. However, as the number of different items of malware that need to be scanned for rapidly increases, the processing resources associated with malware scanning also rapidly increase. This introduces a significant disadvantageous processing load on the computer systems and networks concerned. As an example, on-access scanning of computer files is a technique whereby every access request to a computer file results in malware scanning of that computer file before that request is serviced. Whilst this is a secure operational technique, it does disadvantageously slow down the processing speed and responsiveness of a computer system.
It is known to provide malware scanners that maintain a cache identifying all the computer files that have been recently malware scanned. When a computer file access request is made, a check in the cache is conducted to determine whether that particular computer file has been malware scanned, found to be clean and is unchanged since it was last malware scanned. If the file has already been malware scanned, found to be clean and is unchanged since it was found to be clean, then the file access may be allowed without further malware scanning being required. This approach whilst avoiding unnecessary repeated scanning, does suffer from the disadvantage that significant resources, such as working memory, need to be devoted to storing what can become a very large list of already scanned computer files. If the memory resources devoted to caching is reduced, then this reduces the effectiveness of the technique since the cache may not have sufficient capacity to store details of a sufficient number of all the computer files that have been already scanned so resulting in a need to unnecessarily re-scan some computer files.
It is also known to provide e-mail systems in which the database of stored e-mail messages pre-emptively scanned for malware and if no malware is found classified as being malware-free.
Measures which can maintain security against malware whilst reducing the consumed processing resources and/or the impact upon system responsiveness are strongly desirable.